codegraph: Instructions file for Codex

AGENTS.md

codegraph AGENTS.md is an instructions file for Codex, OpenCode from lzehrung/codegraph. It costs 3,250 tokens per session, scanned A, original, MIT.

A set of project instructions for coding agents working on the Codegraph repository. It covers coding rules, project-wide and folder-specific guidance, caching, tests, documentation, and review safety.

In plain words
What is it for?
Guiding code changes and reviews in Codegraph, including writing conditions, updating tests and documentation, and respecting rules that apply to particular paths.
Why use it?
It tells the agent what standards to follow before changing code. This helps avoid unsafe edits, weak tests, outdated documentation, and style violations.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md.

This is lzehrung/codegraph's own configuration. It tells Codex and OpenCode how to work on codegraph itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything codegraph configures →

Reuse

Borrowing it

Nothing to install: this file belongs to lzehrung/codegraph. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/lzehrung/codegraph/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/lzehrung/codegraph

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for codegraph AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/lzehrung/codegraph/agents-md/github.svg)](https://agentmods.dev/instructions/lzehrung/codegraph/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/lzehrung/codegraph/agents-md"><img src="https://agentmods.dev/badge/instructions/lzehrung/codegraph/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for codegraph AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/lzehrung/codegraph/agents-md"><img src="https://agentmods.dev/badge/instructions/lzehrung/codegraph/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 3,250 This file is loaded in full into every session.
When invoked 3,250 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.03250 $0.03250
Opus 5.5 $0.01300 $0.01300
Sonnet 5.5 $0.00650 $0.00650
Haiku 4.5 $0.00325 $0.00325

Measured today against content hash 3a2ed6d96208, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

codegraph AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 151 lines

How it starts

The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENT DIRECTIVES

General

  • Never use any or as unknown as
  • Never use nested ternary expressions. Use if/else, a helper function, or named intermediate values instead.
  • Never use === true, === false, etc. in boolean conditions; keep them as terse and simple as possible like !condition. Extract conditions to variables when the variable name adds clarity/insight into the reason for the condition.
  • Split dense compound conditions into named predicates or guard clauses. Name the domain decision, not the expression. Preserve short-circuit evaluation and avoid extra scans or allocations.
  • In boolean condition contexts, use the shortest syntactically equivalent expression. Prefer items.length over items.length > 0, !items.length over items.length === 0, and items?.length over items && items.length > 0.
  • Always consider the impact of a change on tests or when more test cases are needed. Never make tests pass for the sake of passing; always exercise real behavior.
  • Treat the actual implementation as the only evidence of behavior. Check node names, fields, and APIs against the dependency version and runtime actually in use. Parsing without error, or a query that compiles, does not prove that it matches or produces the intended result.
  • Cover inclusion and exclusion together. Assert what must be found and what must stay absent, and include neighboring cases where scope, nesting, comments, or ordinary formatting can change the outcome.
  • Verify a change through its consumers, not only at the seam you edited. A correct extractor does not prove correct discovery, resolution, navigation, or reporting. Keep a shared rule consistent across every consumer. Native is required; there is no reduced mode. Keep a valid empty result distinct from unsupported, unavailable, or failed work.
  • Always keep documentation updated and accurate while being minimal and concise.
  • Add a concise [Unreleased] entry for user-visible behavior, CLI output, support, compatibility, or user-facing fixes. Skip test-only, internal refactoring, and formatting-only changes; state why in the PR when omitted.
  • Keep paragraphs to no more than 4 concise sentences. Prefer bullets for dense details.
  • Keep README.md as the landing page and docs index. Do not turn it back into the only canonical reference for every example and workflow.
  • When public-facing install, runtime, CLI, library API, MCP, agent workflow, or release guidance changes, update the relevant canonical docs in the same change: README.md, docs/installation.md, docs/cli.md, docs/library-api.md, docs/mcp.md, docs/agent-workflows.md, docs/how-it-works.md, and PUBLISHING.md as applicable.
  • Public PR titles, bodies, comments, and release notes MUST NOT include local paths, machine names, usernames, shell prompts, worktree details, or session details. Describe portable commands and observed behavior instead.
  • For repo-understanding flows, start with node ./dist/cli.js doctor and node ./dist/cli.js orient --root . --budget small --json when dist is built; build first if validating the working tree from a fresh checkout.
  • For source-checkout validation and contributor examples, prefer node ./dist/cli.js ...; reserve bare codegraph ... for published/global install guidance.
  • When package metadata, install scripts, native dependencies, or the resolved npm graph changes, update package-lock.json in the same change and verify with npm ci --ignore-scripts --dry-run unless lifecycle scripts are part of the behavior under test. Release-candidate package installs MUST also disable lifecycle scripts unless those scripts are under test.
  • Treat --root as the project boundary for config lookup, path confinement, and output normalization. Cache/manifests may use the resolved cache anchor (--cache-dir/CODEGRAPH_CACHE_DIR, repository metadata, or project root); cached contents remain project-relative.
  • Keep discovery glob guidance accurate: codegraph.config.json globs are project-root-relative, while CLI --include-glob/--ignore-glob values are one-off filters relative to each active scan root.
  • Within any claimed cross-language capability, behavior should stay consistent across all supported languages for that capability. Avoid language-subset branches; if a limitation is intentional, document it in the parity docs and cover it with explicit tests in the same change.
  • When language support changes, update docs/language-parity.md and docs/scenario-catalog.md in the same change so support claims, limitations, and fixture coverage stay aligned.
  • When adding or changing a cross-file language scenario, add or update the nearest language test in tests/languages/*.test.ts and the shared semantic coverage in tests/goto.test.ts, tests/references.test.ts, and tests/native-semantic-parity.test.ts when the language uses the native runtime.
  • Always keep the README.md table of contents updated whenever README sections are added, removed, or renamed.
  • Human-readable CLI output is a public contract. User-facing writeCliOutput(...) callsites must provide a command-specific formatter unless the output is intentionally scalar or JSON-first, and the same change should add or update a pretty-output test.
  • Progress MUST identify the active operation. Show a count only when it is meaningful; do not report zero progress for work with no measurable total.
  • When CLI commands, flags, or output contracts change, update both docs/cli.md and codegraph-skill/codegraph/SKILL.md in the same change.
  • Always keep codegraph-skill/codegraph/SKILL.md updated when CLI commands, flags, or capabilities change. This file is the skill definition used by agents and must reflect the current tool surface.
  • Documentation and tool descriptions MUST name the exact CLI command, MCP tool, or exported API. Do not replace it with vague nouns such as "orientation", "navigation", or "targeted search".
  • Describe aggregate operations precisely: name the first-pass retrieval and derived context, and state when planning, subquery decomposition, or runtime proof is absent. Do not describe parser/backend quality as query reasoning.
  • Recommend direct primitives before bounded aggregators. Do not label an aggregate tool as the first step when exact symbol, reference, call, or file-dependency tools apply.
  • Keep each surface role-specific: help and tool descriptions give the selection rule; CLI/API docs give the contract; skills give command order. Avoid repeating tutorials across surfaces.
  • Distinguish library/session-only features from CLI/config features explicitly. If a capability exists only in exported library APIs, docs and types must say so, and CLI/config surfaces must not imply support they do not implement.
  • When changing MCP notification, transport, or progress behavior, verify both the protocol seam and the serving seam users actually hit (HTTP/stdio); do not assume protocol-level behavior survives a transport wrapper unchanged.
  • Before major commits or concluding work, run npm run check to verify formatting, lint, build, and tests together. During iteration, use the narrowest meaningful test command: targeted Vitest suites for localized changes, npm run test:fast for broader TypeScript changes, npm run test:integration for CLI/report/output contracts, and npm run test:native when touching packages/codegraph-native.
  • Installation guidance must use @lzehrung/codegraph and the @lzehrung GitHub Packages registry. Keep detailed install docs in docs/installation.md.
  • Any persistent storage schema change (e.g. SQLite tables/columns/indexes) MUST include a migration path for existing on-disk data. If using CREATE TABLE IF NOT EXISTS, you must also ALTER TABLE / backfill as needed (or introduce explicit schema versioning) and add a regression test that starts from an older schema to prove upgrades work.
  • DO NOT use curly quote variants or other non-standard characters humans would not type with a standard QWERTY keyboard.
  • Duplicate-tokenizer fingerprints must not shift with the toolchain. The TypeScript and native identifier grammars are pinned to one Unicode version: the native side through the exact unicode-ident pin in packages/codegraph-native/Cargo.toml, the TypeScript side through the generated src/duplicate-identifier-ranges.ts. Never resolve that grammar with a Unicode property escape, which follows the host Node build's Unicode version. Changing the crate pin means rerunning npm run generate:duplicate-identifier-ranges and bumping DUPLICATE_TOKENIZER_REVISION in the same change, so cached duplicate units tokenized by the previous grammar are recomputed instead of surviving DUPLICATE_UNIT_CACHE_MAX_AGE_MS.
  • packages/codegraph-native/Cargo.lock is committed because the crate ships prebuilt binaries. Update it in the same change as any Cargo.toml dependency edit.

Read the full file on GitHub · 151 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +1 lines · +33 tokens per session 3a2ed6d96208
  2. 17d ago Changed · +20 lines · +321 tokens per session 6254d5d543fb
  3. 1mo ago Changed · +6 tokens per session ea32d2f6898e
  4. 1mo ago Changed · +9 lines · +142 tokens per session 7fae83adc208
  5. 1mo ago Changed · +5 lines · +77 tokens per session ab0b3c02dd6f
  6. 1mo ago Changed · +35 lines · +499 tokens per session 22f6eefe6c67
  7. 1mo ago Changed · +10 lines · +163 tokens per session 4c534f776d52
  8. 2mo ago Changed · +1 lines · +48 tokens per session 548e70b7f107
  9. 2mo ago Changed · +1 lines · +42 tokens per session 9a7b06127f19
  10. 2mo ago First seen · 69 lines · 1,919 tokens per session scan A 4fac441d4c2e

Subscribe to this mod's changes

codegraph AGENTS.md is an instructions file published in the GitHub repository lzehrung/codegraph (9 stars, last pushed today), licensed MIT. It adds 3,250 tokens to every session, about $0.0130 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

codegraph AGENTS.md compared with instructions from other repositories

codegraph AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
codegraph AGENTS.mdlzehrung/codegraphInstructions file9todayMITA3,250Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195ktodayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143ktodayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149ktodayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195ktodayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195ktodayMITA3,093GitHub Copilot
vscode ai-customization.instructions.mdmicrosoft/vscodeInstructions file195ktodayMITA1,907GitHub Copilot